xtremerat | eaaba57cc79456d1e6bb723455ffc20a4470d289afa82d4099d8028e4e62210d

Analysis

max time kernel
187s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 20:04

Target

eaaba57cc79456d1e6bb723455ffc20a4470d289afa82d4099d8028e4e62210d.exe
Size

87KB
MD5

0e6d3c9da778238d0e4e2fe70b9d3cad
SHA1

820d83ccbd3ffc715d9b226f855fc0605d7c5d2d
SHA256

eaaba57cc79456d1e6bb723455ffc20a4470d289afa82d4099d8028e4e62210d
SHA512

b37d98bf4d6bfd7cc38f17580e0aaf561ba73958da5a00936b0f614823a32e8d898bf7ea14188d27c83e095711dabd02865db5a4940cb6f8174e8210e1623b19
SSDEEP

1536:h9vQN7SiCXn4SYsA0tyQuJ5iqzoo5wST+JlgMmx3b:71Xn4zsAH5iqj5GlAb

Score

10^/10

Detect XtremeRAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/1948-55-0x0000000010000000-0x0000000010064000-memory.dmp	family_xtremerat
behavioral1/memory/1948-56-0x0000000010000000-0x0000000010064000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\eaaba57cc79456d1e6bb723455ffc20a4470d289afa82d4099d8028e4e62210d.exe
"C:\Users\Admin\AppData\Local\Temp\eaaba57cc79456d1e6bb723455ffc20a4470d289afa82d4099d8028e4e62210d.exe"
1⤵
PID:1948

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1948-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1948-55-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download
memory/1948-56-0x0000000010000000-0x0000000010064000-memory.dmp

Filesize
400KB

Download